backend

Package acl implements per-user / per-file&folder access control for filex.

Package antivirus wraps ClamAV behind a small Scan API ("Koru" v0.4).

Package api — demo_guard.go

Package handlers — account_rules.go

Package apierr is the one shape of a failure filex tells somebody about: a stable CODE a program branches on, the values its sentence takes, and the sentence itself, written by the SERVER in the reader's language.

Package appstore is filex's side of an app store (docs/APP-PLUGINS.md → Installing from a store, Paid apps; docs/APP-PLUGINS-API.md → The store contract): the stores an administrator trusts, the install links a store hands out, and the licenses of paid apps, which the store issues, keeps and is asked about.

Package storetest is a fake app store for tests: the `/v1/` paths a filex reads (docs/APP-PLUGINS-API.md → The store contract), signing exactly as a store must - ed25519 over the lower-hex sha256 of the canonical payload - and every answer adjustable mid-test (a tampered signature, a 410, a key that changes, a store that cannot be reached).

Package archivecli runs operator-provided archive tools behind a small, fixed interface.

Package assoc decides which handler opens a kind of file and which draws its thumbnail (filex 0.50, docs/APP-PLUGINS.md → Default apps).

Package auth — audit_middleware.go

Package apitoken implements bearer-token authentication for non-interactive callers: AI agents, the work.example.com FilexClient, and the embedded MCP server.

Package ldap implements simple-bind LDAP/Active Directory authentication.

Package local implements username + password authentication backed by the users table.

Package multioidc dispatches OIDC flows to per-tenant IdP realms (docs/MULTI-TENANCY.md §5,§7).

Package oidc implements OpenID Connect authentication.

Package pam is the Linux operating-system sign-in provider: a person signs in to filex with the login they use on the machine filex runs on, and PAM — the same door SSH and su use — judges the password.

Package proxyheader implements authentication via headers injected by a trusted upstream reverse proxy (nginx, Caddy, oauth2-proxy, Cloudflare Access, Authelia, …).

Package windows signs people in with their Windows account: a local account of the machine filex runs on, or a domain account of the domain it is joined to.

Package authsetup builds the instance's sign-in providers and keeps the live set of them — the ONE place a provider is constructed, whether the environment/config file or the Admin → Identity providers page asked for it.

Package basepath serves filex under a path prefix — a "sub-path deployment", `https://example.com/filex/` behind a reverse proxy — and answers, for the code that builds browser-facing URLs, "what is this install's base?".

Package capability probes runtime feature availability — both binary tools (ffmpeg, gs, imagemagick, rsvg) and external HTTP services (OnlyOffice, Drawio).

Package cliclient implements the HTTP client behind `filex client` — the subcommand family that talks to a REMOTE filex server over its public REST API.

Package clientip is the ONE answer to "which address is this request from?".

Package cloud is the self-serve cloud/SaaS PREPARATION skeleton (v0.7 "Kimlik" E3 — docs/CLOUD.md).

Package coedit is filex's relay for editing a file together (task #189): the server half of the app SDK's `coedit.*` bridge methods, for an app granted `files:co-edit` (docs/APP-PLUGINS-API.md → Editing together).

Package comments implements flat, chronological comment threads on file/folder nodes (v0.6 "Çalışma" (Work) wave, migration 00020).

Package compat is filex's compatibility window for what storage plugins and apps send it.

Package config loads filex configuration from a YAML file with environment variable overrides (FILEX_*).

Package confine implements per-request root confinement for the /api/files surface.

Package dailycheck is the daily beat the update checks run on — the app plugins' (wasmplugin/updates.go) and the storage plugins' (plugin/updates.go): a check a day after the last one, never sooner than a short wait after start, with the time of the last run kept in the settings table so a restart neither skips a day nor checks at every boot.

Package dav exposes filex storages as a WebDAV server under /dav.

Package davlock is the WebDAV lock system, and it exists because the one filex shipped with was a lie.

Package db defines a Driver interface that wraps a *sql.DB and exposes the typed Store interface used by the rest of the codebase.

Package mysql is the MySQL/MariaDB DB driver.

Package postgres is the PostgreSQL DB driver.

Package sqlite is the SQLite DB driver.

Package dbsetting — bool.go

Package diskfree probes the free space on the filesystem holding a directory.

Package drafts holds what the draft feature (issue #71) keeps outside the HTTP layer: the per-person limit, and the key a draft is filed under.

Package e2e carries the server-side AWARENESS of client-side (E2E) encrypted folders — nothing more.

Package fxewatch is the server's own record of a rewritten single encrypted file (`.fxe`): an audit row for every rewrite of one, and — when the rewrite changed its password or recovery slot — the deletion of the older versions that still open the file with the old secret.

Package slotchange is what the server does when a write changed a KEY SLOT of something end-to-end encrypted - the password or the recovery slot of an encrypted folder's key file (`.filex-e2e.json`, e2e/keyfilewatch) or of a single encrypted file's header (`.fxe`, e2e/fxewatch): who may retire the old copies that still open it with the old secret, and who is told.

Package e2epolicy — audit.go

Package editkind is the server's one answer to "how is this file edited": as text (the built-in editor, saved through save-text), in the document server (ONLYOFFICE), or not at all here.

Package enginebin answers one question for the whole server: which of the heavy conversion programs - ffmpeg, ImageMagick, Ghostscript, poppler, rsvg - are installed here, and which binary each one is.

Package external is the one place the runtime asks "how is OnlyOffice / drawio configured right now?".

Package filebody answers the one question every surface that serves file bytes has had to ask since uploads became staged: where are this file's bytes RIGHT NOW?

Package filecache keeps a local copy of a big file that lives on a slow backend, so that the request which pays for the transfer is honest about it ("preparing… 40 %") and every request after it is served at local-disk speed.

Package filesync keeps a local folder and a remote filex folder in step.

Package ftpsrv serves FTPS: filex, reached by the equipment that only ever learned one protocol.

Package group is what groups of people (migration 00074, docs/GROUPS.md) do beyond storing rows: checking a group before it is stored, keeping the memberships an outside directory decides in step with it, and keeping each member's built-in level in step with the role their group gives them.

Package httpx holds the small HTTP details that have to be identical everywhere filex writes a response.

Package identity owns the rules for account login names, and the single door that turns a typed identifier into a user.

Package identitystore guarantees that every account has a login name.

Package keylock serialises work per key: one holder of a key at a time, any number of keys at once.

Package listorder is the ONE order the server puts rows in: a folder's contents (from the catalogue, from the storage driver or merged), the MCP `file_list` tool, and the per-person views (Recent, Starred, Shared with me, a tag).

Package loginguard limits how many wrong sign-in attempts an account and an address may make, for every door a password can be typed at: the web form, WebDAV, FTPS, SFTP.

Package mailer sends transactional email (share/invite notices) over an operator-configured SMTP server.

Package memcache is filex's ONE in-process cache for small state and settings that live in the database: a bounded, expiring map (Cache), and the same map kept in front of a durable store, written through it in both directions (Through).

Package metrics is filex's Prometheus surface.

Package mountfs is the filesystem behind `filex mount` — a remote filex server, seen as a folder on the machine that runs the command.

Package namefold is the one rule for when two spellings of a name are the same text: what a search compares, and the part of a tag's identity that is about letters rather than whitespace.

Package netguard is the one answer to "may filex dial this address?".

Package newdoc answers one question: what are the BYTES of a brand-new, empty document of type X?

Package nfssrv serves NFSv3: filex, mounted as a network drive by anything on the LAN that speaks the NAS protocol.

Package nodefilter is the server's rule for "which of these rows does a search's narrowing keep": the kind of file, its mime type, when it was modified, how big it is, which folder it is in, who owns it and whether it is a hidden (dot) name.

Package notify is filex' notification subsystem.

Package observability wires optional Sentry-wire error reporting (e.g.

Package onlyoffice integrates a self-hosted OnlyOffice Document Server with filex storage backends.

Package ops manages the async queue of long-running file operations (copy/move/delete) so the HTTP request can return promptly while the actual byte movement happens in a worker goroutine.

Package originguard refuses a state-changing request that a browser sent from somewhere other than filex itself, on a person's behalf (cross-site request forgery).

Package pathkey derives the storage-scoped cache key (a node's path_hash) that addresses rows in the nodes table.

Package perm is filex's per-user permission model: 29 named permissions, the presets built from them, and the resolver that turns an account's role, the install's defaults, the permission rules that match it and its own overrides into one answer per permission — with where that answer came from, so "why can't they do this?" has a reply.

Package permgap tells administrators about the saved roles that allow a permission but not the one carved out of it (perm/gaps.go): adding files but not encrypting, as a save on a version without files.encrypt leaves them.

Package plugin lets a storage driver live OUTSIDE the filex binary.

Command gen writes driver_shapes.go: one concrete type per capability combination a plugin can declare.

Package testplugin runs a real filex storage plugin — the HTTP/JSON protocol of internal/plugin, served over httptest — so any package that consumes a storage.Driver can be exercised against a PLUGIN-backed storage without spawning a second process.

Package pluginlog is the log an administrator reads on a plugin's page - an app plugin's (internal/wasmplugin) and a storage plugin's (internal/plugin) alike - and the one rule that keeps it, and the server log behind it, from drowning in a single repeated line.

Package pluginreq is the "leave a request" half of installing a plugin.

Package printframe serves the page filex prints an app's PDF from (`ui.print`, task #189).

Package protocolauth is the single door through which every non-HTTP protocol gets its caller.

Package protocolsync keeps the DB node cache, the search index, the thumbnails and the write hooks in step with what a protocol server just did to the bytes.

Package protoperm is the one place the protocol front ends (ftpsrv, sftpsrv, nfssrv, dav, s3api) ask per-user permissions (package perm) about a path.

Package queue is filex' driver-based persistent operation queue.

Package postgres is the production HA queue driver.

Package redis is the Redis-backed queue driver.

Package sqlite is the default queue driver, sharing the filex DB file with the metadata store.

Package quota tracks per-user storage usage and enforces the users.quota_bytes ceiling at upload time.

Package quotastore is the single place where per-user storage usage is accounted.

Package realtime implements the WebSocket hub behind filex's live collaboration surface: per-folder "rooms" that broadcast (1) file-change events so every viewer's listing updates without a manual refresh and (2) presence so viewers can see who else is in the same folder and which file each is focused on.

Package regfile opens files that are REGULAR files, and nothing else.

Package replica is the orchestration layer that ties the storage ReplicatedDriver to the DB (failure rows, rules, settings) and to the notify subsystem (webhook + bell events).

Package rowgate keeps a storage's catalogue judgements apart from the changes filex makes to that storage in two steps.

Package s3api serves the S3 wire protocol on top of filex storages.

Package scanrule is the ONE answer to "does the scan walk this path of this storage?" (issue #44).

Package search wraps the embedded Bleve index used for fast filename (and optionally content) lookup across all storages.

Package extract turns file bytes into plain text for the search index's `content` field ("Bul" wave, v0.2).

Package secheaders sets the response headers filex sends for the browser's sake on every answer, whatever serves it and wherever filex is deployed — so every self-hosted install has them, not only one whose reverse proxy adds them:

Package secretbox encrypts the secrets filex must be able to READ BACK.

Package server contains the HTTP server lifecycle, the first-run detector that bootstraps an admin user, and the boot banner.

Package sftpsrv serves SFTP: filex, seen by every client that already knows how to talk to a file server over SSH.

Package share manages public download tokens with optional PIN protection, expiry, and download caps.

Package sharezip caches the ZIP archive produced when a shared FOLDER is downloaded ("download all").

Package srvtext is the catalogue of every sentence the SERVER writes to a person: e-mails, the no-JavaScript pages behind a share or drop link, the Apps install review's permission descriptions, the NOT.txt beside a drop.

Package staging is filex's own upload staging area: the bytes of an upload land here first, on local disk, and are transferred to the storage driver afterwards by a background op.

Package storage provides the abstract Storage Driver interface used to front any byte-stream backend (local FS, S3, SFTP, WebDAV, …).

Package ftp is a Storage Driver fronting a plain FTP (or FTPS) server.

Package local is a Storage Driver fronting an on-disk directory.

Package s3 is a Storage Driver fronting any S3-compatible object store.

Package sftp is a Storage Driver fronting an SSH/SFTP server.

Package smb is a Storage Driver fronting an SMB2/3 share — a NAS, a Windows file server, a Samba box.

Package webdav is a Storage Driver fronting a WebDAV server.

Package stall bounds how long a storage driver waits for a backend that does not answer, without ever cutting a transfer that keeps moving.

Package storageref resolves the first path segment of a file-protocol address to a storage.

Package sync implements the storage-to-DB sync worker.

Package syspath is the ONE definition of the directories filex keeps for itself inside a storage, and of how a path is judged against them.

Package tagname decides what a tag is CALLED and when two tags are the SAME.

Package tenancy is the multi-tenant mode switch: where the mode a server runs with comes from, and what turning it on or off would mean.

Package tenant carries the resolved tenant (provider) scope through a request.

Package tenantdomain is a tenant's own domains (docs/TENANT-ADMIN.md, "Addresses and own domains"): adding one, proving it, keeping it proven.

Package tenantstore wraps a db.Store so storage listings are confined to the request's tenant scope (see docs/MULTI-TENANCY.md).

Package tenanturl answers one question for the whole server: which origin should an absolute URL that filex hands out be built on?

Package testutil provides shared helpers for unit + integration tests across the filex codebase.

Package archivetest builds hostile archives for tests.

Package dbtest provides minimal DB+model test helpers without depending on auth/capability/share — so it is safe to import from the test files of those packages without creating an import cycle.

Package fakeidp is a minimal OpenID Connect provider for tests: discovery, a JWKS, an authorization endpoint that signs the current identity in at once, a token endpoint that answers with an RS256-signed id_token for that identity, and an end-session endpoint (RP-initiated logout) that records who asked.

Package fakemagick writes a stand-in for ImageMagick: a shell script that answers the way an ImageMagick of a given kind does, so the code that runs ImageMagick (enginebin.HEIC, thumb.generateHEIF) is tested through a real exec, on a machine that has no ImageMagick at all.

Package gatetest catches a two-step change half way and asks whether the storage's row gate (internal/rowgate) is held there.

Package lives3 tells the suites that talk to a REAL S3 server which one: the FILEX_TEST_S3_* variables, read in one place.

Package wasmfixture guards the tests that load the echo app fixture (internal/wasmplugin/testdata/echo/echo.wasm): the module is built, and it was built from the sources beside it.

Package throughput is the process-wide answer to one question: "how fast is this storage right now?"

Package thumb generates and serves thumbnail images for nodes.

Package svgwasm draws SVG files with resvg compiled to WebAssembly, run in the pure-Go wazero runtime: the SVG engine filex carries itself, so an SVG gets a thumbnail on every install (the full image, :slim, the bare binary) without rsvg-convert and without cgo.

Package tokenperm is the catalogue of an API key's permissions that come in LEVELS: what a key may do with one kind of thing beside its files - read it, or read and write it.

Package trash implements retention-based purging of soft-deleted nodes.

Package update implements filex's release awareness: it learns which versions exist, decides what may be applied automatically, and (on installs that own their binary) applies them.

Package usage answers a question filex could not answer at all: what does the storage behind it cost?

Package vaultlock is the vault's write lock (encryption level 3, docs/E2E-VAULT-FORMAT.md → The write lock): at most one session writes a vault, and the server is what says which.

Package version exposes build-time version metadata.

Package versioning persists historical snapshots of node contents inside the same storage backend, under a `.versions/<node_id>/<version_n>` prefix.

Package wasmplugin runs filex "app plugins": WebAssembly modules executed inside the filex process by wazero (through the Extism host SDK), with no access to the host's filesystem, network, environment or database — only to the host functions filex exposes, each gated by a permission the administrator granted at install.

Package webpush sends Web Push messages: RFC 8030 delivery, the payload encrypted for the receiving browser (RFC 8291, "aes128gcm") and every request signed with the application server's VAPID key (RFC 8292).

Package writegate is the one question every person-facing write asks before it touches a storage: may this path be changed?

Package writehook is the single post-write side-effect gate for every file-producing/mutating surface (manager, AI/MCP, ShareX, DAV, async ops worker).

Package zipstream is the one place filex turns a set of files into a ZIP that is written out as it is built.